SQL6-D0-003600 - SQL Server must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

CAT|II

CCI|CCI-000054

Rule-ID|SV-213929r1018580_rule

STIG-ID|SQL6-D0-003600

STIG-Legacy|SV-93825

STIG-Legacy|V-79119

Vuln-ID|V-213929

SQL6-D0-003700 - SQL Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-213930r1043176_rule

STIG-ID|SQL6-D0-003700

STIG-Legacy|SV-93827

STIG-Legacy|V-79121

Vuln-ID|V-213930

SQL6-D0-003900 - SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-213932r960792_rule

STIG-ID|SQL6-D0-003900

STIG-Legacy|SV-93831

STIG-Legacy|V-79125

Vuln-ID|V-213932

SQL6-D0-004100 - SQL Server must protect against a user falsely repudiating by ensuring the NT AUTHORITY SYSTEM account is not used for administration.

CCI|CCI-000166

Rule-ID|SV-213934r960864_rule

STIG-ID|SQL6-D0-004100

STIG-Legacy|SV-93835

STIG-Legacy|V-79129

Vuln-ID|V-213934

SQL6-D0-004200 - SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the instance.

Rule-ID|SV-213935r960864_rule

STIG-ID|SQL6-D0-004200

STIG-Legacy|SV-93837

STIG-Legacy|V-79131

Vuln-ID|V-213935

SQL6-D0-004300 - SQL Server must be configured to generate audit records for DoD-defined auditable events within all DBMS/database components.

CCI|CCI-000169

Rule-ID|SV-213936r960879_rule

STIG-ID|SQL6-D0-004300

STIG-Legacy|SV-93839

STIG-Legacy|V-79133

Vuln-ID|V-213936

SQL6-D0-004400 - SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

CCI|CCI-000171

Rule-ID|SV-213937r960882_rule

STIG-ID|SQL6-D0-004400

STIG-Legacy|SV-93841

STIG-Legacy|V-79135

Vuln-ID|V-213937

SQL6-D0-004600 - SQL Server must generate audit records when successful/unsuccessful attempts to retrieve privileges/permissions occur.

CCI|CCI-000172

Rule-ID|SV-213939r960885_rule

STIG-ID|SQL6-D0-004600

STIG-Legacy|SV-93845

STIG-Legacy|V-79139

Vuln-ID|V-213939

SQL6-D0-004700 - SQL Server must initiate session auditing upon startup.

CCI|CCI-001464

Rule-ID|SV-213940r960888_rule

STIG-ID|SQL6-D0-004700

STIG-Legacy|SV-93847

STIG-Legacy|V-79141

Vuln-ID|V-213940

SQL6-D0-005500 - SQL Server must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-213941r960909_rule

STIG-ID|SQL6-D0-005500

STIG-Legacy|SV-93851

STIG-Legacy|V-79145

Vuln-ID|V-213941

SQL6-D0-005600 - SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

CCI|CCI-000140

Rule-ID|SV-213942r1043188_rule

STIG-ID|SQL6-D0-005600

STIG-Legacy|SV-93853

STIG-Legacy|V-79147

Vuln-ID|V-213942

SQL6-D0-005700 - SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Rule-ID|SV-213943r1043188_rule

STIG-ID|SQL6-D0-005700

STIG-Legacy|SV-93855

STIG-Legacy|V-79149

Vuln-ID|V-213943

SQL6-D0-005900 - The audit information produced by SQL Server must be protected from unauthorized access, modification, and deletion.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-213944r960930_rule

STIG-ID|SQL6-D0-005900

STIG-Legacy|SV-93857

STIG-Legacy|V-79151

Vuln-ID|V-213944

SQL6-D0-006300 - SQL Server must protect its audit configuration from authorized and unauthorized access and modification.

CCI|CCI-001494

Rule-ID|SV-213948r960942_rule

STIG-ID|SQL6-D0-006300

STIG-Legacy|SV-93865

STIG-Legacy|V-79159

Vuln-ID|V-213948

SQL6-D0-006500 - SQL Server must limit privileges to change software modules and links to software external to SQL Server.

CCI|CCI-001499

Rule-ID|SV-213950r960960_rule

STIG-ID|SQL6-D0-006500

STIG-Legacy|SV-93869

STIG-Legacy|V-79163

Vuln-ID|V-213950

SQL6-D0-006600 - SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.

Rule-ID|SV-213951r960960_rule

STIG-ID|SQL6-D0-006600

STIG-Legacy|SV-93871

STIG-Legacy|V-79165

Vuln-ID|V-213951

SQL6-D0-006900 - Default demonstration and sample databases, database objects, and applications must be removed.

CCI|CCI-000381

Rule-ID|SV-213954r960963_rule

STIG-ID|SQL6-D0-006900

STIG-Legacy|SV-93877

STIG-Legacy|V-79171

Vuln-ID|V-213954

SQL6-D0-007000 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-213955r960963_rule

STIG-ID|SQL6-D0-007000

STIG-Legacy|SV-93879

STIG-Legacy|V-79173

Vuln-ID|V-213955

SQL6-D0-007100 - Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.

Rule-ID|SV-213956r960963_rule

STIG-ID|SQL6-D0-007100

STIG-Legacy|SV-93881

STIG-Legacy|V-79175

Vuln-ID|V-213956

SQL6-D0-007200 - Access to xp_cmdshell must be disabled, unless specifically required and approved.

Rule-ID|SV-213957r960963_rule

STIG-ID|SQL6-D0-007200

STIG-Legacy|SV-93883

STIG-Legacy|V-79177

Vuln-ID|V-213957

SQL6-D0-007300 - Access to CLR code must be disabled or restricted, unless specifically required and approved.

Rule-ID|SV-213958r960963_rule

STIG-ID|SQL6-D0-007300

STIG-Legacy|SV-93885

STIG-Legacy|V-79179

Vuln-ID|V-213958

SQL6-D0-007400 - Access to Non-Standard extended stored procedures must be disabled or restricted, unless specifically required and approved.

Rule-ID|SV-213959r960963_rule

STIG-ID|SQL6-D0-007400

STIG-Legacy|SV-93887

STIG-Legacy|V-79181

Vuln-ID|V-213959

SQL6-D0-007500 - Access to linked servers must be disabled or restricted, unless specifically required and approved.

Rule-ID|SV-213960r1018585_rule

STIG-ID|SQL6-D0-007500

STIG-Legacy|SV-93889

STIG-Legacy|V-79183

Vuln-ID|V-213960

SQL6-D0-007800 - SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-213963r1051115_rule

STIG-ID|SQL6-D0-007800

STIG-Legacy|SV-93895

STIG-Legacy|V-79189

Vuln-ID|V-213963

SQL6-D0-007900 - If DBMS authentication using passwords is employed, SQL Server must enforce the DOD standards for password complexity and lifetime.

CCI|CCI-000192

CCI|CCI-004066

Rule-ID|SV-213964r1112499_rule

STIG-ID|SQL6-D0-007900

STIG-Legacy|SV-93897

STIG-Legacy|V-79191

Vuln-ID|V-213964

SQL6-D0-008000 - Contained databases must use Windows principals.

Rule-ID|SV-213965r1018610_rule

STIG-ID|SQL6-D0-008000

STIG-Legacy|SV-93899

STIG-Legacy|V-79193

Vuln-ID|V-213965

SQL6-D0-008200 - If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-213966r1051304_rule

STIG-ID|SQL6-D0-008200

STIG-Legacy|SV-93901

STIG-Legacy|V-79195

Vuln-ID|V-213966

SQL6-D0-008800 - SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

CCI|CCI-000804

Rule-ID|SV-213970r961053_rule

STIG-ID|SQL6-D0-008800

STIG-Legacy|SV-93907

STIG-Legacy|V-79201

Vuln-ID|V-213970

SQL6-D0-009500 - SQL Server must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-213972r961128_rule

STIG-ID|SQL6-D0-009500

STIG-Legacy|SV-93911

STIG-Legacy|V-79205

Vuln-ID|V-213972

SQL6-D0-009600 - The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.

Rule-ID|SV-213973r961128_rule

STIG-ID|SQL6-D0-009600

Detections

Analytics

DISA MS SQL Server 2016 Instance STIG v3r5 MS_SQLDB

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Apr 8, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Feb 13, 2026 Miscellaneous Metadata updated.

Detections

Analytics

DISA MS SQL Server 2016 Instance STIG v3r5 MS_SQLDB Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA MS SQL Server 2016 Instance STIG v3r5 MS_SQLDB